Hellman: "When Whit Diffie and I published New Directions in Cryptography in 1976 (I always talk in terms of Whit Diffie and me, because we were working together. Ralph Merkle was also working, independently, at Berkeley, and he was involved integrally in terms of public key cryptography), we thought that widespread use of encryption was five years, or at the most, ten years away. It turns out we were wrong by a factor of 2 to 10. Visionaries see the future better than average persons, but we were too optimistic. & We have been somewhat concerned with the limited gene-pool in public key cryptography. When we developed public key cryptography, we thought there would be a wide range of choices for public key crypto systems, just as there is a wide range of choices for conventional crypto. When they did the Advanced Encryption Standard (AES) call for algorithms, they got about 15 algorithms, and they could have had more; whereas, in public key cryptography, we had the Diffie-Hellman key exchange, and the El Gamal signatures and the RSA public key crypto system. & That is a very limited DNA. In the progress of cryptanalysis, i.e., what we knew in 1976 versus what we knew in 1980 versus what we knew in 1990, there have been major advances made; none of which have actually broken these systems, but which have pushed the acquired key sizes upward. Now I was giving lectures on this in the late 1970s, I would put up slide and propose that the key size for RSA, if you wanted to be conservative, should have been at least two thousand bits. And I pointed out that if you factored in one more advance you might need as much as ten thousand bits. Now, with the advances we have seen, one more could push us up beyond ten thousand bits. So elliptic curve needs to be looked at, but even with elliptic curve it is a more limited gene pool than we would like. It is potentially vulnerable."
Power: One might have assumed that laptops would be routinely encrypted by now.
Hellman: "Even more so back-up tapes. Since the 1970s, I have been saying that back-up tapes should be encrypted. They are only occasionally accessed. Encrypting them if the key is stored someplace else is not a problem. With a laptop, people have to have the key. But given what has happened you would think that the cost-benefit trade off of the trouble with entering a key would be well worth it."
Power: Is cost the limiting factor?
Hellman: "No, it is the adolescent behavior. It is the difficulty human beings have in contemplating a world different from what they have seen. Even though they have read about these laptops being stolen, it has not happened to them. & Adults take responsibility for their actions, adolescents do not. 'I am going to go a hundred miles an hour and I am not going to kill myself.'"
Power: When I do executive briefings, or sessions for general audiences, I always start with a list of the top ten risks and threats, at the top of the list are nuclear proliferation and climate change and at the bottom of the list is cyber security. I don't do it to imply that cyber risks and threats are not problems worthy of treatment as national and even global security issues, but only to level-set, to say, 'OK, we are talking about cyber security, it is a very important topic, but let's keep it in perspective.' What is your thinking about the ranking of cyber security in the overall threat matrix? And about the resources and attention committed to it, are they commensurate, disproportionate, or inadequate?
Hellman: "The underlying problem for all of these [risks and threats] is this chase between our technological power and our adolescent development. So there is an underlying theme to all of these which we need to get people to see, so that they recognize that they are not really dealing ten different problems, they are dealing with one fundamental source of all these problems. Although it is also important to recognize that the list is not static. In 1976, when we published New Directions, automated teller machines had just come in, and the SWIFT network for transferring funds internationally had already come in, and in talks I gave I could see the potential for the day coming when buying a loaf of bread would be done with an electronic funds transfer; and, if that I happened, even if someone did not steal all the money, if they just crashed the system and brought it down, our economy could come to a standstill. If you look at the pace of our dependency on computers and communications, and project out, it is going to move up on the list. If you think about all of the potential damage that could be done now, power plants, nuclear power plants, weapons systems, it is getting harder and harder to isolate these proprietary computer and communications networks from the Internet; and people are finding ways to tunnel in. Cyber security could become an existential threat as we become more and more wired."
Power: Tell us about your risk analysis project? What are you attempting with it?
Hellman: "I am on the advisory board of a start-up company. I met the CFO at a holiday party, and said, 'Let me put it this way, if I told you that there was an uninsurable risk that your company faced, and there was a roughly 10% chance of it destroying your company in the next 10 years, and you could do something to reduce that risk, would you be interested?' Unless something becomes socially acceptable, it is very hard for organizations to do anything about it. To change policy, we have to get to 50% penetration. On nuclear weapons, we are probably at one-tenth of 1% in terms of really recognizing the risk. The most critical part is getting to somewhere around 5%. Getting half the population seems impossible, half the population is so entrenched in the current way of doing things. But five percent is much more do-able, it is not a magic number, it could be two percent or maybe as much as ten percent. It is around five percent that the average person comes in contact with on one or two people a week and talks about the issue. The first time they hear it they will ask, 'Why we should we be involved?' And underneath that is the unstated belief that if it were really a major problem everybody would be talking about it."
Power: So it isn't denial?
Hellman: "It is denial, but it is mass denial. We are much more herd creatures than we would like to belief, myself included. I used to think that I was not susceptible fashion. Bell bottoms were really cool in the 1970s, and now they look ridiculous. There is the same mentality with respect to what issues we pay attention to. Evolutionarily, it probably made sense. But the world is changing so fast now, that we need to find ways to speed up the propagation of more ideas that are needed. The web can really help do that. In the 1980s, when I worked on nuclear weapons, and I tried to get the public's attention, it took about two months from the time a new person become interested until the time that person could be to propagate the idea. That person had to be educated and become comfortable talking about it. There were books, but getting someone to buy a book is a huge threshold, versus being able to talk about it to someone. Today, if a person comes to my web site, or another one, and likes what they see, even if they do not understand it all, if they have not yet integrated it, they can send an e-mail with that link, no one has to buy a book, and they can send that e-mail to a hundred people in a matter of minutes, and the time it takes to get to those people is a day or less in terms of when they look at their e-mail. The propagation, both the numbers you can reach and the speed at which you can reach them, has increased, literally, by orders of magnitude."
Power: What do you see as the greatest obstacle to overcome?
Hellman: "People can't get their minds around the numbers. They are mind-boggling. 'One death is a tragedy, but a million deaths are a statistic.' Even at the current levels, it's as if every other person in Palo Alto were a nuclear weapon. Imagine how you would feel if a nuclear power plant was built next to your house. Now imagine how you would feel if another one was built on the other side. And then another, and then another. And then more and more pop up until there are a thousand nuclear power plants surrounding your home, and that is the minimal risk that my preliminary analysis indicates each and every one of us faces. People would be up in arms about having nuclear weapons in Palo Alto, and yet they are not worried about missiles that are six to eight thousand miles away, could reach us in thirty minutes and aimed at us, or in submarines off our coast that could reach us in ten minutes. It is invisible. That's the problem. You have to make it visible. I came up with this idea as I was studying the economic collapse. People had been warning, credible people, including Warren Buffet, who is supposed to be the 'Oracle of Omaha,' in 1994, this is a thirty-five trillion world-wide market, because federally insured banks are involved in this, the taxpayer is going to pay for it. And it was closer to six hundred trillion dollars by the time it actually burst. That's more than the world's GDP. Even the 'Oracle' wasn't listened to."
Power: What does it means to be a Cassandra? Your evoking of this myth resonates with my personal experience, and I am sure with the personal experience of other risk, security and intelligence professionals. What does the role demands of us? How does one cope with the role and the pushback it elicits?
Hellman: "Calling someone a Cassandra in our society has a highly negative connotation. And I did a little reading, and looked at some of the art. Cassandra is often portrayed as a madwoman. But the mythology is that Apollo gave her the gift of prophecy. But she spurned his advances. And then he cursed her and no one would believe her. She warns the citizens of Troy: 'Don't bring the damn thing in here.' They ignore her. Of course, she acts like a madwoman. She is beside herself, 'How do I stop people from doing this?' But the interesting thing about Cassandra is that she was always right. Just as we must not be afraid to be a fool, we must not be afraid to be a Cassandra."
You can learn more about Hellman's work at http://nuclearrisk.org ##.
Richard Power is a Distinguished Fellow at Carnegie Mellon CyLab and a frequent contributor to CSO Magazine. He writes, speaks and consults on security, risk and intelligence issues. He has conducted executive briefings and led professional training in forty countries. Power is the author of five books. Prior to joining Carnegie Mellon, Power served as Director of Security Management and Security Intelligence for the Global Security Office (GSO) of Deloitte Touche Tomatsu and Editorial Director of the Computer Security Institute.
This story, "Cyber Security, the Nuclear Threat and You" was originally published by CSO.